> Tesla offers a “Root access program” on their bug bounty program. Researchers who find at least one valid “rooting” vulnerability will receive a permanent SSH certificate for their own car, allowing them to log in as root and continue their research further.
Pretty interesting. Sounds like Apple's Security Research Device Program[0], where you're loaned a rooted iPhone, but with a clear qualification criteria.
It strikes a nice balance, because to qualify you have to 1) show you have the skills to get root access anyway and 2) show you're willing to participate in the bug bounty program and get things patched.
I would of course love root on everything I own, but I can understand Tesla's motivation here since root for everyone would make vulnerability discovery easier for malicious actors. And if everyone had root on their Tesla, it'd be much easier to make naughty modifications that might catch the ire of regulators. (like disabling driver attentiveness checks in self-driving mode).
It feels like this is something you should get by being owner of the car, and not have to do free speculative research for the manufacturer to get it.
They've also revoked certificates from researchers personal cars in the past
It's pretty amazing what Claude + Ghidra + knowledgable coaching can accomplish. It was basically just setting direction, setting up an incremental workflow with the right kind of documentation, and questioning some of its theories and assumptions from time to time.
I'd love to release a lot of it but I'm torn between releasing artifacts created with expensive software I paid for and thinking that many of those things should really be freely available to anyone (specifically the things which definte the protocol to talk to the car and mapping of what various things are reported vs what they actually mean.
"Early on, the notebook computer and LCD vendors commonly used the term LVDS instead of FPD-Link when referring to their protocol, and the term LVDS has mistakenly become synonymous with Flat Panel Display Link in the video-display engineering vocabulary."
https://en.wikipedia.org/wiki/Low-voltage_differential_signa...
So LVDS is more likely to linger in automotive displays, while in less obsolete devices it has been replaced by either eDP or by MIPI DSI (used e.g. in smartphones).
https://x.com/i/status/1722717318009041104
DM me if interested
Put a voltmeter on the battery terminals of a regular car at 2000rpm and note the voltage. You'd be surpised (the alternator can produce as high as 15V on some cars).
Not understanding this sentence. Most running ICE vehicles product closer to that 14.4 than 12v. I think a standard controller would have worked fine?
Given the presence of the wiring schematics and the mechanical dimensions, I'm surprised that the author did not try to 3D-print the mechanical parts of the connectors, givem that the electrical parts extracted from the BMW connectors did fit.
Completely unrelated. Would be interested if you figure out how to retrofit the new adaptive shocks on performance models to the older cars. Something I would love to do if I had hobby time. I'm pretty sure they fit physically, but needs to be connected to the main computer. I likely would never touch the main computer unless I got root access. In my brain I was thinking about a separate system made with raspberry pi's.
Fwiw, mine costs $450 from Ford. Also in the US we call this a wiring harness, with the loom being the material that goes over the wires
Violet HSD Code D 4+2 Pin Female to D Female Jack Connector 6 Pin HSD LVDS High Speed DataTransmission Harness Wire LVDS Cable https://a.aliexpress.com/_EuGOh9e
And a soldering robot with a specialist a few rooms away to beam down the latest errata into physical form, at times.
Tracy Kidder just died, and Soul of a New Machine was a favorite of my formative years as an engineer. Once I started in headunit ECU development it felt very familiar to me at times.
I'm a software guy, but the gear has a lot of allure.
Hey, I just remembered my school used to have ages ago some cool power supplies (I think from Agilent?) that were very idiot proof, they had current limit with a dial that I think didn’t went over 1A or perhaps even less, and they would instantly disarm on short circuit (and indicate it with a led), and also the voltage dial I think wouldn’t go over 25V. I remember it was very big and heavy, but it survived countless students that used the lab daily.
Nowadays, is there any power supply available that is that resistant or is the recommended approach to get an used old one? Does anyone have a power supply at home that is also used by kids with a brand/model they would recommend? Thanks!
https://www.mouser.com/c/power/power-supplies/power-supplies...
AT $5k it better make me breakfast, too.
If you want that sort of reliability it will probably go towards 100$.
> A REST-like API on :8080 which returned a history of “tasks”
I am curious to know what kind of historical tasks- since it's a media control unit; does it show what kind of media was being played in the last trip? does it reveal any other info about the driver?? There might be a privacy angle here that you could exploit and share it with Tesla.
In Tesla terms, the infotainment does much more than just playing music - it has full access to the rest of the car.
I have a Model 3, but I can't say I follow the forums.. but I've never heard of screens failing -- I'm sure it happens but I think if it was common problem I'd have heard of it.
Turns out the early Model S vehicles used consumer grade LCD panels that weren’t designed for the prolonged high heat you get in a metal and glass box left outside in the sun all day.
Tesla since upgraded their vehicle screens to proper automotive-grade LCDs which are excellent.
My point is, automotive-grade hardware is higher spec than regular consumer computer hardware, hence the high prices.
As an aside, I upgraded my whole computer and screen from MCU1 to MCU2 and it was worth the upgrade.
Credit to Tesla for building a retrofit computer upgrade for old vehicles. Thats a non-trivial thing to engineer and I appreciate their effort. Other car manufacturers would prefer you were compelled to buy their latest vehicle instead.
"To promote further security research, Tesla offers security researchers the opportunity to retain root access on their infotainment system even after their reported vulnerability has been patched. In order to qualify, a researcher must send in a valid report describing a novel way to gain root access on a Tesla infotainment system. Upon confirmation, Tesla will instruct the researcher on how to use their existing root access to enable the researcher SSH feature, along with an SSH certificate for the researcher's public key (tailored to their specific hardware ID). The certificate restricts SSH access to the local diagnostic ethernet link. Tesla may renew the certificate as long as the researcher continues reporting vulnerabilities."
Very neat.
I was really surprised to read this at the end of the article -- how could someone be this deep into a project of this depth and not realize this?! Not only because all cars (...er... all vehicles) are wired this way, but also because the documentation they were referencing has plenty of detail to show this... there's even a whole picture of it (and to Tesla's credit they have amazing free docs): https://service.tesla.com/docs/Model3/ServiceManual/2024/en-...
I think this is a software guy who occasionally dips into hardware things (to hunt bugs).
Not to Tesla's credit, they had to be dragged kicking and screaming into it (primarily by Massachusetts) and their right to repair legislation through a solid chunk of malicious compliance:
1. When told that they had to have a site for people to order parts, Tesla put up a site that had every single item as "Call us", including the most simple of bolts. And when a few places called, "Sorry, that's not available to you".
2. The service manual was originally only available in a few locations in MA, and had strict conditions: you had to book in advance, there was a $100 fee per booking, and you could only view the manual on premises, and could not bring electronic devices into the room with you, just pen and paper.
The docs they have are great, and who knows how their attitude would have changed over time, but they absolutely didn't want you to have it, initially.
Usually, for most other vehicles, the connectors are either standardized (e.g. radios, ISO 10487 [1], high-current chargers by VG 96917) or the foundation plugs, sockets and re-pinning tools are readily available by the vehicle manufacturer or by aftermarket suppliers.
Tesla truly went out of their way to make the life of third parties (such as wire harness repair shops) more miserable here.
As an Australian. I often find myself saying things like “the wiring hardness, or loom, or cable, or whatever were calling it this week”.
Exasperated by living in a state other than the one I grew up in. South Australians are often easily spotted by their pronunciation of certain words.
Now why didn't an AI think of that? :)
